In one embodiment, a device obtains characteristics of a first anomaly detection model executed by a first distributed learning agent in a network. The device receives a query from a second distributed learning agent in the network that requests identification of a similar anomaly detection to that of a second anomaly detection model executed by the second distributed learning agent. The device identifies, after receiving the query from the second distributed learning agent, the first anomaly detection model as being similar to that of the second anomaly detection model, based on the characteristics of the first anomaly detection model. The device causes the first anomaly detection model to be sent to the second distributed learning agent for execution.
Legal claims defining the scope of protection, as filed with the USPTO.
8. The method of claim 1, wherein the anomaly relates to one of an attempt by the first monitored host to exfiltrate data, an attempt by the first monitored host to connect to a command and control (C2) channel, or scanning activity by the first monitored host.
9. The method of claim 1, wherein the centralized agent also performs a supervisory function over the first DLA.
17. The computer-readable medium of claim 10, wherein the anomaly relates to one of an attempt by the first monitored host to exfiltrate data, an attempt by the first monitored host to connect to a command and control (C2) channel, or scanning activity by the first monitored host.
18. The computer-readable medium of claim 10, wherein the centralized agent also performs a supervisory function over the first DLA.
20. The system of claim 19, further comprising a device configured to modify a processing of network traffic from the first monitored host responsive to the first DLA modifying the anomaly detection process.
21. The system of claim 19, further comprising a second DLA, the second DLA comprising one or more third network devices, each third network device including a processor, memory, and a network connection; and wherein the centralized agent is further configured to receive information about anomalies from the second DLA.
22. The system of claim 21, wherein the centralized agent is further configured to use information about anomalies from the first DLA and the second DLA as input to the machine learning process.
23. The system of claim 19, further comprising a second DLA, the second DLA comprising one or more third network devices, each third network device including a processor, memory, and a network connection; and wherein the centralized agent is further configured to send the threat detection information to the second DLA.
24. The system of claim 23, wherein the second DLA is configured to modify the anomaly detection process based on the threat detection information received from the centralized agent.
25. The system of claim 23, further comprising a device configured to modify a processing of network traffic responsive to the second DLA updating the anomaly detection process.
26. The system of claim 19, wherein the anomaly relates to one of an attempt by the first monitored host to exfiltrate data, an attempt by the first monitored host to connect to a command and control (C2) channel, or scanning activity by the first monitored host.
27. The system of claim 19, wherein the centralized agent also performs a supervisory function over the first DLA.
Cooperative Patent Classification codes for this invention. Click any code to explore related patents in that topic.
February 22, 2022
December 3, 2024
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.